Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Sam Virus!


  • This topic is locked This topic is locked
5 replies to this topic

#1 tranquil

tranquil

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:43 AM

Posted 17 September 2008 - 11:55 AM

I have been infected with a virus which calls itself SAM. Everytime I try to do something a message pops up from SAM. For eg: When I open Task Manager a message pops up which says:

What's wrong with the processes?
-SAM-

Or when I open Firefox:

Try something else, IE and Opera are not bad!
-SAM-

I have posted a HijackThis! log. Please help me remove this. I think it came from a friend's pen drive which I was using. I had also removed AVG two days ago because it was causing problems. I also got 'You have a large number of hijacked domains' when i used HJT. I think that's caused by the virus too.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:09:29 PM, on 9/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\System32\database.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Eset\nod32krn.exe
C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
C:\Config\system.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator.NAWAF-517FEC36A\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ads.sify.com/RealMedia/ads/click_lx...ridlog=nadeem_d
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\System32\database.exe,
O1 - Hosts: 127.1 localhost
O1 - Hosts: 127.1 vt0r48p760.cn
O1 - Hosts: 127.1 www.1txx.com
O1 - Hosts: 127.1 www.myovec.cn
O1 - Hosts: 127.1 po.uc-us.cn
O1 - Hosts: 127.1 219.139.83.20
O1 - Hosts: 127.1 www.msj007.cn
O1 - Hosts: 127.1 www.wyf009.cn
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 59.34.148.68
O1 - Hosts: 127.1 208.43.165.86
O1 - Hosts: 127.1 208.43.166.171
O1 - Hosts: 127.1 219.153.71.185
O1 - Hosts: 127.1 61.164.140.39
O1 - Hosts: 127.1 www.dsabh.cnwww.dsabh.cn
O1 - Hosts: 127.1 cwk1237.3322.org
O1 - Hosts: 127.1 www.woaigan.com
O1 - Hosts: 127.1 munchkin.marketo.net
O1 - Hosts: 127.1 post.marketo.net
O1 - Hosts: 127.1 www.mv2z.cn
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.wq9q.cn
O1 - Hosts: 127.1 facaizhifuok.cn
O1 - Hosts: 127.1 www.wo9188.cn
O1 - Hosts: 127.1 a.woaigan.com
O1 - Hosts: 127.1 b.woaigan.com
O1 - Hosts: 127.1 xxx.usxx.info
O1 - Hosts: 127.1 alenxya.1122mb.com
O1 - Hosts: 127.1 www.972se.com
O1 - Hosts: 127.1 972se.com
O1 - Hosts: 127.1 pic.03wyt.com
O1 - Hosts: 127.1 d.03wyt.com
O1 - Hosts: 127.1 xs.03wyt.com
O1 - Hosts: 127.1 www.8jse.net
O1 - Hosts: 127.1 8jse.net
O1 - Hosts: 127.1 www.bmwtvb.cn
O1 - Hosts: 127.1 www.kcuf-09.cn
O1 - Hosts: 127.1 www.dvgdfg4650.com
O1 - Hosts: 127.1 www.kcuf-08.cn
O1 - Hosts: 127.1 www.kcuf-11.cn
O1 - Hosts: 127.1 www.kcuf-12.cn
O1 - Hosts: 127.1 1aa1aa.com
O1 - Hosts: 127.1 xx.avno3.com
O1 - Hosts: 127.1 xxx.avno5.com
O1 - Hosts: 127.1 www.avno7.com
O1 - Hosts: 127.1 avno7.com
O1 - Hosts: 127.1 ok.avno4.com
O1 - Hosts: 127.1 ok.avno5.com
O1 - Hosts: 127.1 ok.avno6.com
O1 - Hosts: 127.1 ok.avno7.com
O1 - Hosts: 127.1 ok.avno9.com
O1 - Hosts: 127.1 avno1.com
O1 - Hosts: 127.1 avno3.com
O1 - Hosts: 127.1 avno4.com
O1 - Hosts: 127.1 aikanav.com
O1 - Hosts: 127.1 link.selink.org
O1 - Hosts: 127.1 www.avno6.com
O1 - Hosts: 127.1 avno6.com
O1 - Hosts: 127.1 4.chibbs.info
O1 - Hosts: 127.1 bbs.chibbs.info
O1 - Hosts: 127.1 aa.ss99.biz
O1 - Hosts: 127.1 se.ss99.biz
O1 - Hosts: 127.1 aa.sxlk.net
O1 - Hosts: 127.1 se.sxlk99.com
O1 - Hosts: 127.1 www.88xj.net
O1 - Hosts: 127.1 88xj.net
O1 - Hosts: 127.1 www.99xj.net
O1 - Hosts: 127.1 99xj.net
O1 - Hosts: 127.1 www.91semi.com
O1 - Hosts: 127.1 91semi.com
O1 - Hosts: 127.1 haobaidu.1122mb.com
O1 - Hosts: 127.1 xiao777.za.pl
O1 - Hosts: 127.1 ccavo6.avno6.com
O1 - Hosts: 127.1 a.sxlk99.com
O1 - Hosts: 127.1 www.91vva.cn
O1 - Hosts: 127.1 www.qq08w12.cn
O1 - Hosts: 127.1 www.21xx.info
O1 - Hosts: 127.1 php-1.cn
O1 - Hosts: 127.1 www.v232.com
O1 - Hosts: 127.1 php-2.cn
O1 - Hosts: 127.1 php-3.cn
O1 - Hosts: 127.1 php-4.cn
O1 - Hosts: 127.1 php-5.cn
O1 - Hosts: 127.1 php-6.cn
O1 - Hosts: 127.1 php-7.cn
O1 - Hosts: 127.1 php-8.cn
O1 - Hosts: 127.1 php-9.cn
O1 - Hosts: 127.1 php-10.cn
O1 - Hosts: 127.1 php-11.cn
O1 - Hosts: 127.1 k.5x2x.com
O1 - Hosts: 127.1 a.5x2x.com
O1 - Hosts: 127.1 202.108.23.205
O1 - Hosts: 127.1 60.190.218.21
O1 - Hosts: 127.1 121.14.154.195
O1 - Hosts: 127.1 218.30.82.201
O1 - Hosts: 127.1 59.34.198.48
O1 - Hosts: 127.1 121.14.154.216
O1 - Hosts: 127.1 219.152.120.237
O1 - Hosts: 127.1 121.14.154.184
O1 - Hosts: 127.1 125.67.67.201
O1 - Hosts: 127.1 222.168.102.12
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [winsystem] C:\Documents and Settings\Administrator\WINDOWS\system\winsystem.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Policies\Explorer\Run: [winlogon] C:\Config\system.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wrm32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C68DBAE-C4EA-4926-96F9-D52AB013DB77}: NameServer = 202.144.115.4,202.144.66.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4EE67727-44D2-4689-A9C7-35FD103115B1}: NameServer = 202.144.115.4,202.144.66.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - AppInit_DLLs: qxfel.dll eskisl.dll micsus.dll cupops.dll jolndyo.dll lensch.dll johandy.dll aotoppt.dll pewire.dll catower.dll wllame.dll,HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBFS2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dll,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBDNF.dll,HBWARLORDS.dll,HBTL.dll,HBPICKCHINA.dll,HBCT.dll,HBGC.dll,HBHM.dll,HBHX2.dll,HBQQHX.dll,HBTW2.dll,HBQQSG.dll,HBQQFFO.dll,HBZT.dll,HBMIR2.dll,HBRXJH.dll,HBYY.dll,HBMXD.dll,HBSQ.dll,HBTJ.dll,HBFHZL.dll,HBWLQX.dll,HBLYFX.dll,HBR2.dll,HBCHD.dll,HBTZ.dll,HBQQXX.dll,HBWD.dll,HBZG.dll,HBPPBL.dll,HBXMJ.dll,HBJTLQ.dll,HBQJSJ.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: slbiopfs2.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - (no file)
O21 - SSODL: mstimewd.dll - {65056902-6E7B-4bd7-95BA-688DB5FA5BEB} - (no file)
O21 - SSODL: adsntzt.dll - {E0F3526A-4165-4589-80CD-50B6FBAC3BDA} - (no file)
O21 - SSODL: dispexcb.dll - {76D44356-B494-443a-BEDC-AA68DE4255E6} - (no file)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: DesktopWin - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - C:\WINDOWS\AppPatch\DesktopWin.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

--
End of file - 10033 bytes

BC AdBot (Login to Remove)

 


#2 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 17 September 2008 - 05:53 PM

Hello. I am PropagandaPanda (Panda or PP for short) and I will be helping you with your log.

I will need some time to look over your computer's log(s). I am still in training, so my responses to you must be checked by a coach.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Posted Image button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.

Please take note of a few guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it may not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Finally, please reply using the Posted Image button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
With Regards,
The Panda

Important Note to Other Users Reading this Topic: The instructions provided in this topic are for the original topic starter only. Even if you have similar problems or log entries to those given here, please do not follow the directions, especially those involving specific tools and scripts. Doing so can result in serious damage to your computer. Instead, please start your own topic. Feel free to link to any relevant topics as needed.

#3 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 19 September 2008 - 07:20 AM

Hello tranquil.

You have a pretty bad infection. Seems to be a new one going around.

Posted ImageBackdoor Threat
I'm sorry to say that your computer is infected with one or more backdoor trojans.

This means that sensitive information could have been stolen. I would advise to change any passwords for any accounts that you have accessed with the infected computer using a clean computer ASAP. If you have used this computer for banking, I would strongly suggest that you report the possible stolen information. Please do not use the computer for any further transactions, or to enter any other information, if at all possible, until it is declared clean.

You may want to read this article on how to handle identity theft.
You may also want to read this article regarding preventing of identity theft.

This computer can still be cleaned, however, I cannot guarantee that it will be 100% safe even after disinfection.

Please read When Should I Format, How Should I Reinstall.

I will proceed assuming you wish to disinfect. If you want to do a reinstall, reply back saying so.

Install Recovery Console and Run ComboFix
Download Combofix from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Select the download that's appropriate for your Operating System.

Posted Image
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Download the file and save it as it's originally named onto your desktop.
  • Close any open windows, including this one.
  • Drag the setup package onto ComboFix.exe and drop it.


    Posted Image
  • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  • At the next prompt, click NO to skip the scan for now.
Posted Image
  • Click on your Start Menu, then Run.., then type:
    "%userprofile%\desktop\combofix.exe" /killall
  • When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running.

ComboFix will restart your computer if malware is found; allow it to do so.



Reply back with the ComboFix log pasted into your post.

With Regards,
The Panda

Edited by PropagandaPanda, 19 September 2008 - 07:20 AM.


#4 tranquil

tranquil
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:43 AM

Posted 19 September 2008 - 02:39 PM

Hi Panda,

I really appreciate your help but i have already started the cleanup process with the help of bob4 from WhatTheTech Forums. Here's the link to my topic there if you want to check it out:

http://forums.whatthetech.com/Infected_wit...rus_t95442.html

Much of what he advised is same as what you have. Again thanks for the help. You guys keep up the good work!

#5 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 19 September 2008 - 03:27 PM

Hello tranquil.

Thanks for letting us know.

For future reference, please try to avoid starting topics in more than one forum, as it can create some confusion, and more problems if two people are trying to fix one computer.

With Regards,
The Panda

#6 harrythook

harrythook


  • Security Colleague
  • 4,152 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philadelphia
  • Local time:09:13 PM

Posted 19 September 2008 - 06:37 PM

As this issue seems to be resolved, this thread will now be closed.
If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you.
Include the address of this thread in your request.
For all others, if you have a similar issue please start a new topic.

Thanks for asking in BleepingComputer.com

Veni Vidi Vici
THE FIGHT AGAINST MALWARE

Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users